pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6 cfg = config.programs.firejail;
7
8 wrappedBins = pkgs.stdenv.mkDerivation rec {
9 name = "firejail-wrapped-binaries";
10 nativeBuildInputs = with pkgs; [ makeWrapper ];
11 buildCommand = ''
12 mkdir -p $out/bin
13 ${lib.concatStringsSep "\n" (lib.mapAttrsToList (command: binary: ''
14 cat <<_EOF >$out/bin/${command}
15 #!${pkgs.stdenv.shell} -e
16 /run/wrappers/bin/firejail ${binary} "\$@"
17 _EOF
18 chmod 0755 $out/bin/${command}
19 '') cfg.wrappedBinaries)}
20 '';
21 };
22
23in {
24 options.programs.firejail = {
25 enable = mkEnableOption "firejail";
26
27 wrappedBinaries = mkOption {
28 type = types.attrs;
29 default = {};
30 description = ''
31 Wrap the binaries in firejail and place them in the global path.
32 </para>
33 <para>
34 You will get file collisions if you put the actual application binary in
35 the global environment and applications started via .desktop files are
36 not wrapped if they specify the absolute path to the binary.
37 '';
38 };
39 };
40
41 config = mkIf cfg.enable {
42 security.wrappers.firejail.source = "${lib.getBin pkgs.firejail}/bin/firejail";
43
44 environment.systemPackages = [ wrappedBins ];
45 };
46
47 meta.maintainers = with maintainers; [ peterhoeg ];
48}